California's crackdown on data privacy enters 'beta-testing' limbo

If California’s new digital privacy law were a smartphone app, the 18-month period between its passage and its effective date might be considered beta testing.

Gov. Jerry Brown signed the measure, one of the strictest such laws in the U.S., on Thursday. It won’t take effect until Jan. 1, 2020, however, a gap intended to give the tech industry time to work with lawmakers on tweaking it after a rushed passage that forestalled an even more stringent ballot initiative by the Californians for Consumer Privacy campaign.

“This is a flawed bill that came out of a hasty process with virtually no public debate,” a tech industry official familiar with the law said. “The bill’s authors have already noted that significant changes are needed before any 2020 implementation can occur.“

The new law reflects broad pressure on federal and state governments to protect consumer data following the 2017 hack of credit bureau Equifax, which exposed information for nearly half the country, and the disclosure this year that a consultant for President Trump’s 2016 campaign improperly accessed files on some 87 million Facebook users.

Similar to the EU’s new privacy rules, the bill will allow Californians to review data companies hold on them and block the firms from selling that information. State Sen. Robert Hertzberg and state Assemblymember Ed Chau introduced the legislation late last week to thwart the ballot initiative sponsored by real estate developer Alastair Mactaggart, which had garnered more than 600,000 signatures of support.

Mactaggart, whose business focuses on the San Francisco Bay area, spent almost $3.5 million of his own fortune on the proposal, which Californians for Consumer Privacy agreed to withdraw if the state enacted a bill by Thursday.

Telecommunications firms and tech giants alike spent heavily to stop the initiative: Facebook, Google, Microsoft, Uber, and Amazon contributed a combined $840,000 to the the Committee to Protect California Jobs, an opposition campaign, and Comcast, AT&T, and Verizon chipped in $200,000 each.

A data privacy bill at the federal level, meanwhile, has languished. U.S. Sens. Amy Klobuchar, a Minnesota Democrat, and John Kennedy, a Louisiana Republican, introduced the Social Media Privacy Protection and Consumer Rights Act of 2018 in late April, and it was referred to the chamber’s Commerce Committee.

As written, the proposal would empower consumers to block collection of their data by companies such as Facebook and Twitter as well as bar them from sharing it. It would mandate that the platforms inform users prior to creating an account that their personal data would be collected and possibly shared and notify them within 72 hours of a data breach.